CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.13 is vulnerable due to a bypass in the API-key scope restrictions, allowing super account API keys to execute operations like demo resets without proper permission checks. This could lead to unauthorized access to demo data and control, particularly if the demo mode is configured with writable resources. Organizations utilizing this plugin in demo environments should prioritize patching to mitigate potential misuse of demo functionalities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.